A new OT vulnerability alert from CISA

Last month we hosted RaptorCon 26, bringing together O&Ms, EPCs, insurers, independent engineers and asset managers from across the solar industry.

One theme showed up consistently across conversations: the industry is continuing to move away from manual asset management toward automation-driven operations.

Technologies like robotics, autonomous drones, and advanced analytics are enabling operators to inspect sites more frequently across much broader protocols, perform more comprehensive QA/QC during commissioning, and collect better operational data across fleets.

As portfolios scale, the opportunities - and the need - to apply automation are expanding. Not least, cybersecurity obligations tied to NERC compliance. Maintain asset inventories, track training, manage access, manage vulnerabilities and patching, and collect continuous evidence.

We summarized the most important takeaways in this article.

Industry Update ⚡️

CISA flags vulnerabilities in widely deployed OT devices

CISA (Cybersecurity and Infrastructure Security Agency) recently added vulnerabilities affecting Hikvision surveillance cameras and Rockwell Automation controllers to its Known Exploited Vulnerabilities catalog.

These devices are widely deployed across the energy infrastructure, from solar farms to industrial controllers used in plant automation and SCADA systems.

If you have any equipment on the KEV list we recommend you:

• Collect a complete asset inventory

• Document patch management history

• Gather evidence of remediation actions

Organizations that can track this continuously, instead of reconstructing it during an audit, will be best positioned to identify and replace vulnerable technology.

Product Updates 🚀

Tracking cybersecurity training across a fleet often ends up in spreadsheets or disconnected tools, making it difficult to confirm who is up-to-date and what evidence exists.

The Raptor Comply Training Module (now in beta) puts training directly inside the compliance workflow.

Administrators can:

• Create training modules with mixed-media content

• Assign training based on roles and system access

• Track completion across the organization

• Automatically generate evidence and reminders before deadlines hit

Training management lives alongside your policies, assets, and tasks, so audit evidence is created alongside the rest of your program.